3

I have watched a video explaining assymetric routing today.

In this video, two solutions to AR (among others) are shown:

First solution:

enter image description here

Second solution:

enter image description here

What are the advantages of the second solution exactly? Why do firewalls often care about Session State?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 15 '17 at 1:08
3

I watched the video and thought it only explained a very specific case of AR.

A stateful firewall enforces the TCP protocol rules. If, for example, I want my internal users to browse to the Internet, but no one from the Internet can connect to my internal systems, I can use a stateful firewall to enforce the rule that when packet is received from the Internet, it must match an already existing connection. That is, the internal and external devices have already established a TCP connection by following the protocol rules known as the "3-way handshake." Further, the firewall doesn't allow a packet with the SYN flag set to enter from the Internet (because I don't want connections originating from the Internet).

The firewall enforces these rules by monitoring the "state" of each data flow.

The problem of asymmetrical routing can occur when I have two connections to the Internet and two firewalls. Packets may leave through firewall A, but return through firewall B. In that case, firewall A sees the SYN packet go out and will monitor that state of that connection. But when firewall B sees the SYN-ACK reply packet come in form the outside, it has nothing to match it against. It doesn't know about the packet that firewall A saw, so it treats the SYN-ACK packet as a protocol violation and drops it.

In the 2nd solution, all packets pass through the firewall, so it can correctly monitor the state of each connection.

1
  • That's a good explanation and I have a slightly different question on AR. How would you mitigate AR when you use two ISPs who have no BGP peering agreements and you would prefer all communications to go through Firewall1 which connects to ISP1 and not firewall2 which connects to ISP2 which is the backup.
    – user4565
    Jun 13 '15 at 22:40
0

The second diagram is shows a misconfigured network. The packets should not be traversing a default gateway on the same LAN/subnet as the true gateway to the destination. If the WAN router is in fact behind the LANs DG then the link should reflect that and not be connected to the switch but to the router. The WAN router should be on a different subnet than the LAN DG.

1
  • Ron, someone after you with a grudge? +1 for an informative and correct post. You could've mentioned that ICMP will shorcut the deviation across the DG. Jun 13 '15 at 19:24
0

To answer the first question of the OP: there are no advantages to the AR scenario. On the contrary, the routing is misconfigured (I agree with Ron) but will get corrected by ICMP messages on session setup.

To make it right in the second diagram, the route to the remote LAN should specify the WAN router as gateway, and should be present on each host or server which needs access to the remote LAN. As this involves a lot of effort the first scenario is preferable, with the route to the remote LAN in a central place.
Firewall newer than, say, 10 years are of the stateful kind, and for good reasons.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.